MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 069db9eb6655ea38831e92d501b2ff012757a61a4dd5445110f8e4f7b2a9af7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 19


Intelligence 19 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 069db9eb6655ea38831e92d501b2ff012757a61a4dd5445110f8e4f7b2a9af7e
SHA3-384 hash: bf58ffc8c7d2e0add28d01daedcd365eef246c830f0d12de5ec3e8682229271d66a5c164fc4978d8502bd880b6f15aa8
SHA1 hash: 17c44db8533acca540df53f89297411f6f6f3847
MD5 hash: 6d4b7db96b65b2ab8c2fe5091bc4e2ca
humanhash: cola-nebraska-failed-delaware
File name:Proforma Invoice.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'008'128 bytes
First seen:2026-08-27 06:08:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'199 x AgentTesla, 20'365 x Formbook, 12'365 x SnakeKeylogger)
ssdeep 24576:Jo+wpDc/M5FpmhibWW0ZQeSpn23YZDacXt64LumQzcAKRbn8F:J4Rc/M5+hibX6bR3ZcAwzQMZ
TLSH T12F251254B764FF16C8AE5B751872D37A43B86E8EC927D3178EDDAEEB78103026C00691
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 286064ecc4d0e460 (1 x njrat, 1 x AgentTesla, 1 x Formbook)
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
178
Origin country :
DE DE
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/6d86b61f-3f08-4e78-b5c3-49b534a52b96/
Malware family:
guloader
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-08-27 06:15:10 UTC
Tags:
auto-reg guloader loader stealer ip-check evasion phishing ftp agenttesla exfiltration
Link:
https://app.any.run/tasks/ff153470-fed1-44dc-a285-19a4c31e2399

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/82974/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.27133576.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
DNS request
Connection attempt
Sending an HTTP GET request
Reading critical registry keys
Launching a service
Changing a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/069db9eb6655ea38831e92d501b2ff012757a61a4dd5445110f8e4f7b2a9af7e
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-08-26T23:11:00Z UTC
Last seen:
2026-08-28T03:03:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/069db9eb6655ea38831e92d501b2ff012757a61a4dd5445110f8e4f7b2a9af7e/results?tab=lookup
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8b27c22c-6a99-45e4-844b-ec3f1ce4d10a
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1964518
Signature
Adds a directory exclusion to Windows Defender
Bypasses PowerShell execution policy
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious values (likely registry only malware)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1964518 Sample: Proforma Invoice.exe Startdate: 27/08/2026 Architecture: WINDOWS Score: 100 34 ip-api.com 2->34 44 Suricata IDS alerts for network traffic 2->44 46 Found malware configuration 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 17 other signatures 2->50 8 Proforma Invoice.exe 1 6 2->8         started        12 powershell.exe 11 2->12         started        14 powershell.exe 2->14         started        signatures3 process4 file5 28 C:\Users\user\AppData\Roaming\DHj.exe, PE32 8->28 dropped 30 C:\Users\user\...\Proforma Invoice.exe.log, ASCII 8->30 dropped 52 Creates autostart registry keys with suspicious values (likely registry only malware) 8->52 54 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 8->54 56 Creates an autostart registry key pointing to binary in C:\Windows 8->56 58 2 other signatures 8->58 16 Proforma Invoice.exe 15 2 8->16         started        20 powershell.exe 23 8->20         started        22 conhost.exe 12->22         started        24 conhost.exe 14->24         started        signatures6 process7 dnsIp8 32 ip-api.com 208.95.112.1, 49729, 80 TUT-AS-TotalUptimeTechnologiesLLCUS United States 16->32 36 Tries to steal Mail credentials (via file / registry access) 16->36 38 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 16->38 40 Tries to harvest and steal browser information (history, passwords, etc) 16->40 42 Loading BitLocker PowerShell Module 20->42 26 conhost.exe 20->26         started        signatures9 process10
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/069db9eb6655ea38831e92d501b2ff012757a61a4dd5445110f8e4f7b2a9af7e
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.23 Win 32 Exe x86
Link:
https://app.malva.re/file/6d4b7db96b65b2ab8c2fe5091bc4e2ca
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/069db9eb6655ea38831e92d501b2ff012757a61a4dd5445110f8e4f7b2a9af7e/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Suspicious
First seen:
2026-08-27 02:06:16 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
10 of 36 (27.78%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a2o3t23gkxvdray6slkqdmx7aetvpjq2jxkuiuiq7dsppmvjv57a._file
Verdict:
malicious
Label(s):
AgentTesla
Create hunting rule
Link:
https://reports.threatray.com/10754c79-deae-46d6-9130-d32657362457
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection discovery execution keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/260827-gwjjeazdpb/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Family: AgentTesla
Unpacked files
SH256 hash:
069db9eb6655ea38831e92d501b2ff012757a61a4dd5445110f8e4f7b2a9af7e
MD5 hash:
6d4b7db96b65b2ab8c2fe5091bc4e2ca
SHA1 hash:
17c44db8533acca540df53f89297411f6f6f3847
Link:
https://www.unpac.me/results/7fd4e5da-ba65-437a-9636-1e99cd037c38/
SH256 hash:
2b0a3e1c220e8a98eb358a391da117b853882e411df4c9bbf54acc7ae629061f
MD5 hash:
38181717c94e497221567b84b23a75d0
SHA1 hash:
48332b950e1ee5fb10c3ee5eb8705e01e603edda
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/7fd4e5da-ba65-437a-9636-1e99cd037c38/
Parent samples :
c1a55cc34cd191a3a49c915b056cfea9128261c11438f23eb976b9037026ecd0
069db9eb6655ea38831e92d501b2ff012757a61a4dd5445110f8e4f7b2a9af7e
40c3326300db9e0ed05340ef5b01d05057d7d5970a566fc12232b9fc2748664a
d1303941d2d3f6d1337f74fb0ec07984614d4bad8bb76143fe89a285b9dbeaaf
cc9b6a5d4967278cca9da79ac7a99501d847d1da60d055409abffeadfb4ef761
aa9879b41c127636d0dc71eec88eb08961d2cd7dff6e5ec99b86afdf7ac7b3f7
SH256 hash:
d89ddcde05aabc9b6ff3380bf0d6fa1cea815c8edab0ee358b1332a15977012c
MD5 hash:
b20bb40fb919110368624d2d114f9bc1
SHA1 hash:
82a3ee108ea996d6afa75a0d2b4614c7d17414f7
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/7fd4e5da-ba65-437a-9636-1e99cd037c38/
SH256 hash:
4d08acae8180270235f519d9ec24e27e94c32f5c0370edd122bc6dc1f33a8240
MD5 hash:
3ef62083dc7fcdcad082954d8675b3de
SHA1 hash:
dedbc07d033f66fbb74065c82912d646c54a2d5b
Detections:
triage_agenttesla_infostealer
Create hunting rule
win_agent_tesla_g2
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
MALWARE_Win_AgentTeslaV2
Create hunting rule
Link:
https://www.unpac.me/results/7fd4e5da-ba65-437a-9636-1e99cd037c38/
Parent samples :
4d08acae8180270235f519d9ec24e27e94c32f5c0370edd122bc6dc1f33a8240
069db9eb6655ea38831e92d501b2ff012757a61a4dd5445110f8e4f7b2a9af7e
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/069db9eb6655/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/069db9eb6655ea38831e92d501b2ff012757a61a4dd5445110f8e4f7b2a9af7e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/82974/

Comments